Bug 520997

Summary: firefox crashes when visiting usaa.com
Product: [Fedora] Fedora Reporter: Jeff Garzik <jgarzik>
Component: firefoxAssignee: Martin Stransky <stransky>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: medium    
Version: 11CC: campbecg, gecko-bugs-nobody, linux, mcepl, nix4me, peterm, robatino, stransky, tarek.ahmed.omar, tomek.by, tom
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-03-19 14:11:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
gdb debug info from a firefox crash visting usaa.com
none
Xorg log
none
firefox -g on usaa.com... page loaded fine
none
usaa loaded once then won't load again none

Description Jeff Garzik 2009-09-03 05:04:26 UTC 
Description of problem:
firefox as soon as http://www.usaa.com/ is visited.  You don't have to login, or surf the site, or anything.  Firefox crashes immediately.

Version-Release number of selected component (if applicable):
firefox-3.5.2-2.fc11.x86_64

How reproducible:
always

Steps to Reproduce:
1. optionally clear history/cookies/etc.
2. visit http://www.usaa.com/
3.
  
Actual results:
browser exits

Expected results:
a readable web page

Additional info:
Current version of Firefox/Windows works (as of this writing, Sep 3 2009).
Comment 1 Matěj Cepl 2009-09-22 15:54:10 UTC 
*** Bug 524518 has been marked as a duplicate of this bug. ***
Comment 2 Matěj Cepl 2009-09-22 16:14:31 UTC 
Thanks for the bug report.  We have reviewed the information you have provided above, and there is some additional information we require that will be helpful in our diagnosis of this issue.

First of all, could we get output of the command

	rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin*

Please also install firefox-debuginfo (debuginfo-install is from
yum-utils package).

	debuginfo-install firefox

Then run firefox with a parameter -g --sync. That will start firefox running inside of gdb debugger. Then use command run and in the firefox window go to http://www.usaa.com. When firefox crashes, you should go back to the gdb and run

	(gdb) thread apply all backtrace

This produces usually many screens of the text. Copy all of them into a text editor and attach the file to the bug as an uncompressed attachment.

We will review this issue again once you've had a chance to attach this information.

Thanks in advance.
Comment 3 Matěj Cepl 2009-09-22 16:22:50 UTC 
Note for myself:

there are some interesting upstream bugs which look similar

* https://bugzilla.mozilla.org/buglist.cgi?query_format=specific&order=relevance+desc&bug_status=__open__&content=usaa.com
* https://bugzilla.mozilla.org/show_bug.cgi?id=499338 (with no clear resolution)
* https://bugzilla.mozilla.org/show_bug.cgi?id=507948 (which blames extensions)
* https://bugzilla.mozilla.org/show_bug.cgi?id=500879 (windows-based extension suspect again)

Could you please try to run with -safe-mode option on the command line as well, please? Are you able to reproduce the crash then as well?
Comment 4 Mark 2009-09-22 23:24:38 UTC 
safe mode did not help, still crashes for me.  I will try the debug method later and report back.

Also of note.
Galeon also crashes
Epiphany also crashes
Google Chromium works fine.
Comment 5 Mark 2009-09-22 23:31:30 UTC 
[root@nix4me-desktop yum.repos.d]#  rpm -qa *xulrun* *firefox* *mozilla* *flash* *plugin*
totem-mozplugin-2.26.3-3.fc11.x86_64
gstreamer-plugins-good-0.10.15-4.fc11.x86_64
anaconda-yum-plugins-1.0-4.fc11.noarch
firefox-3.5.3-1.fc11.x86_64
PackageKit-gstreamer-plugin-0.4.9-1.fc11.x86_64
xulrunner-1.9.1.3-1.fc11.x86_64
yum-plugin-fastestmirror-1.1.22-1.fc11.noarch
plymouth-plugin-label-0.7.0-0.2009.05.15.1.fc11.x86_64
nspluginwrapper-1.3.0-6.fc11.x86_64
gdm-plugin-fingerprint-2.26.1-13.fc11.x86_64
plymouth-plugin-two-step-0.7.0-0.2009.05.15.1.fc11.x86_64
gstreamer-plugins-flumpegdemux-0.10.15-6.fc11.x86_64
java-1.6.0-openjdk-plugin-1.6.0.0-29.b16.fc11.x86_64
gstreamer-plugins-base-0.10.24-1.fc11.x86_64
mozilla-filesystem-1.9-4.fc11.x86_64
setroubleshoot-plugins-2.0.18-5.fc11.noarch
PackageKit-yum-plugin-0.4.9-1.fc11.x86_64
alsa-plugins-pulseaudio-1.0.21-2.fc11.x86_64
Comment 6 Mark 2009-09-22 23:46:30 UTC 
Created attachment 362152 [details]
gdb debug info from a firefox crash visting usaa.com
Comment 7 Matěj Cepl 2009-09-23 16:18:23 UTC 
(In reply to comment #4)
> Also of note.
> Galeon also crashes
> Epiphany also crashes
> Google Chromium works fine.  

Midori?
Comment 8 Mark 2009-09-23 23:09:59 UTC 
(In reply to comment #7)
> (In reply to comment #4)
> > Also of note.
> > Galeon also crashes
> > Epiphany also crashes
> > Google Chromium works fine.  
> 
> Midori?  

Midori works fine on usaa.com.
Comment 9 Matěj Cepl 2009-09-29 17:16:43 UTC 
(In reply to comment #6)
> Created an attachment (id=362152) [details]
> gdb debug info from a firefox crash visting usaa.com  

You didn't run that

(gdb) thread apply all backtrace

in the end, so we've got no backtrace there. Please, try again.

Thank you
Comment 10 Nathanael Noblet 2009-10-29 18:03:13 UTC 
works fine for me btw
Comment 11 Mark 2009-10-29 22:34:59 UTC 
The website was fixed.  Works fine now.  Works on all browsers i have tested without updates so the webmaster must have changed something.
Comment 12 Jeff Garzik 2009-10-30 02:59:46 UTC 
Still fails with 3.5.3 and 3.5.4 for http://www.usaa.com/

[jgarzik@bd ~]$ rpm -q firefox
firefox-3.5.3-1.fc11.x86_64

[jgarzik@bd ~]$ rpm -q firefox
firefox-3.5.4-1.fc11.x86_64
Comment 13 Martin Stransky 2009-10-30 08:49:16 UTC 
Reporter, we are still missing a complete backtrace here. But it looks like X/GTK issue, not related to firefox. Try to change your graphics driver (to VESA for instance) or run firefox inside vnc session.
Comment 14 Chris Campbell 2009-11-27 18:04:07 UTC 
Reporter, could you please reply to the previous question? If you won't reply in one month, I will have to close this bug as INSUFFICIENT_DATA. Thank you.

-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers
Comment 15 Matěj Cepl 2009-12-01 17:33:40 UTC 
Reporter, could you please confirm comment 11? If you won't reply in one month, I will have to close this bug as INSUFFICIENT_DATA. Thank you.
Comment 16 Jeff Garzik 2009-12-04 15:40:59 UTC 
I already replied to comment #11, in comment #12:  it still fails.

Installing firefox-debuginfo and running under gdb yields:

(gdb) run
Starting program: /usr/lib64/firefox-3.5.5/firefox 
[Thread debugging using libthread_db enabled]
Missing separate debuginfo for /usr/lib64/libtdb.so.1
Try: yum --enablerepo='*-debuginfo' install /usr/lib/debug/.build-id/56/1175f4b142f66a751e5f31b5f5726780123787.debug
[New Thread 0x7fffeeff0910 (LWP 14672)]
[New Thread 0x7fffee3e5910 (LWP 14673)]
[New Thread 0x7fffed5ff910 (LWP 14674)]
[New Thread 0x7fffec5bd910 (LWP 14675)]
[Thread 0x7fffec5bd910 (LWP 14675) exited]
[New Thread 0x7fffec5bd910 (LWP 14676)]
[New Thread 0x7fffeb5ff910 (LWP 14677)]
[New Thread 0x7fffeabfe910 (LWP 14678)]
[Thread 0x7fffec5bd910 (LWP 14676) exited]
[Thread 0x7fffeb5ff910 (LWP 14677) exited]
[12-04 15:38:10] Torbutton NOTE: Conflict between noncrashed and normal_exit states.. Assuming crash but no session restore..
[12-04 15:38:10] Torbutton NOTE: Crash detected, attempting recovery
[12-04 15:38:10] Torbutton NOTE: Restoring cookie status
[12-04 15:38:11] Torbutton NOTE: Loading non-tor jar after crash
[12-04 15:38:13] Torbutton NOTE: Restoring tor state
[New Thread 0x7fffec5bd910 (LWP 14679)]
[New Thread 0x7fffeb5ff910 (LWP 14680)]
[New Thread 0x7fffe04ff910 (LWP 14681)]
[New Thread 0x7fffdedc9910 (LWP 14682)]
[New Thread 0x7fffde3c8910 (LWP 14683)]
[New Thread 0x7fffdd9c7910 (LWP 14684)]
[New Thread 0x7fffdcbff910 (LWP 14688)]
[New Thread 0x7fffdbaff910 (LWP 14692)]
[Thread 0x7fffdbaff910 (LWP 14692) exited]

Gdk-ERROR **: The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 14438 error_code 11 request_code 53 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)
aborting...

Program received signal SIGABRT, Aborted.
0x0000003b4c4332f5 in *__GI_raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
Current language:  auto; currently minimal
Missing separate debuginfos, use: debuginfo-install ORBit2-2.14.17-1.fc11.x86_64 PackageKit-gtk-module-0.4.9-1.fc11.x86_64 avahi-0.6.25-3.fc11.x86_64 avahi-glib-0.6.25-3.fc11.x86_64 bug-buddy-2.26.0-2.fc11.x86_64 dbus-glib-0.80-2.fc11.x86_64 dbus-libs-1.2.12-2.fc11.x86_64 e2fsprogs-libs-1.41.4-12.fc11.x86_64 elfutils-libelf-0.142-1.fc11.x86_64 expat-2.0.1-6.fc11.1.x86_64 gamin-0.1.10-4.fc11.x86_64 gnome-keyring-2.26.3-1.fc11.x86_64 gtk-nodoka-engine-0.7.2-5.fc11.x86_64 gvfs-1.2.3-13.fc11.x86_64 hunspell-1.2.8-7.fc11.x86_64 keyutils-libs-1.2-5.fc11.x86_64 krb5-libs-1.6.3-20.fc11.x86_64 libICE-1.0.4-7.fc11.x86_64 libSM-1.1.0-4.fc11.x86_64 libX11-1.2.2-1.fc11.x86_64 libXScrnSaver-1.1.3-2.fc11.x86_64 libXau-1.0.4-5.fc11.x86_64 libXcomposite-0.4.0-7.fc11.x86_64 libXcursor-1.1.9-4.fc11.x86_64 libXdamage-1.1.1-6.fc11.x86_64 libXext-1.0.99.1-3.fc11.x86_64 libXfixes-4.0.3-5.fc11.x86_64 libXi-1.2.1-1.fc11.x86_64 libXinerama-1.0.3-4.fc11.x86_64 libXrandr-1.2.99.4-3.fc11.x86_64 libXrender-0.9.4-5.fc11.x86_64 libXt-1.0.5-2.fc11.x86_64 libacl-2.2.47-4.fc11.x86_64 libart_lgpl-2.3.20-4.fc11.x86_64 libattr-2.4.43-3.fc11.x86_64 libbonobo-2.24.1-1.fc11.x86_64 libbonoboui-2.24.1-1.fc11.x86_64 libcanberra-0.12-1.fc11.x86_64 libcanberra-gtk2-0.12-1.fc11.x86_64 libcap-2.16-4.fc11.1.x86_64 libgnome-2.26.0-1.fc11.x86_64 libgnomecanvas-2.26.0-1.fc11.x86_64 libgnomeui-2.24.1-1.fc11.x86_64 libjpeg-6b-45.fc11.x86_64 libogg-1.1.3-11.fc11.x86_64 libpng-1.2.37-1.fc11.x86_64 libselinux-2.0.80-1.fc11.x86_64 libtool-ltdl-2.2.6-11.fc11.1.x86_64 libvorbis-1.2.0-9.fc11.x86_64 libxcb-1.2-4.fc11.x86_64 libxml2-2.7.6-1.fc11.x86_64 nss-3.12.4-3.fc11.x86_64 nss-softokn-freebl-3.12.4-3.fc11.x86_64 openssl-0.9.8k-5.fc11.x86_64 pixman-0.14.0-2.fc11.x86_64 popt-1.13-5.fc11.x86_64 rhythmbox-0.12.3-1.fc11.x86_64 sqlite-3.6.12-3.fc11.x86_64 zlib-1.2.3-22.fc11.x86_64
(gdb) quit
The program is running.  Quit anyway (and kill it)? (y or n) y
Comment 17 Jeff Garzik 2009-12-04 15:43:21 UTC 
gdb backtrace:

#0  0x0000003b4c4332f5 in *__GI_raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x0000003b4c434b20 in *__GI_abort () at abort.c:88
#2  0x000000351e441b27 in IA__g_logv (log_domain=<value optimized out>, 
    log_level=<value optimized out>, format=<value optimized out>, 
    args1=0x7fffffff7500) at gmessages.c:506
#3  0x000000351e441bb3 in IA__g_log (
    log_domain=0x3a36 <Address 0x3a36 out of bounds>, log_level=14902, 
    format=0x6 <Address 0x6 out of bounds>) at gmessages.c:526
#4  0x0000003c78a5c456 in gdk_x_error (display=<value optimized out>, 
    error=<value optimized out>) at gdkmain-x11.c:641
#5  0x0000003b4f0460b4 in _XError () from /usr/lib64/libX11.so.6
#6  0x0000003b4f04c3fc in ?? () from /usr/lib64/libX11.so.6
#7  0x0000003b4f04cdb7 in _XEventsQueued () from /usr/lib64/libX11.so.6
#8  0x0000003b4f035bfd in XPending () from /usr/lib64/libX11.so.6
#9  0x0000003c78a4fa72 in gdk_event_prepare (source=<value optimized out>, 
    timeout=0x7fffffff785c) at gdkevents-x11.c:2325
#10 0x000000351e43a90a in IA__g_main_context_prepare (context=0x7ffff7c59870, 
    priority=<value optimized out>) at gmain.c:2144
#11 0x000000351e43ace1 in g_main_context_iterate (context=0x7ffff7c59870, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2435
#12 0x000000351e43b20a in IA__g_main_context_iteration (
    context=0x7ffff7c59870, may_block=0) at gmain.c:2518
#13 0x00007ffff6c3722f in nsBaseAppShell::DoProcessNextNativeEvent (
    this=0x3a36, mayWait=14902) at nsBaseAppShell.cpp:151
#14 0x00007ffff6c37369 in nsBaseAppShell::OnProcessNextEvent (
    this=0x7fffef32f100, thr=0x7ffff7c1b700, mayWait=1, 
    recursionDepth=<value optimized out>) at nsBaseAppShell.cpp:284
#15 0x00007ffff6cf2310 in nsThread::ProcessNextEvent (this=0x7ffff7c1b700, 
    mayWait=1, result=0x7fffffff7a2c) at nsThread.cpp:508
#16 0x00007ffff6cc3953 in NS_ProcessNextEvent_P (thread=0x3a36, mayWait=14902)
    at nsThreadUtils.cpp:236
#17 0x00007ffff676383c in nsXMLHttpRequest::Send (this=0x7fffe10c44c0, 
    aBody=<value optimized out>) at nsXMLHttpRequest.cpp:2825
#18 0x00007ffff6cfe791 in NS_InvokeByIndex_P (that=0x3a36, methodIndex=14902, 
    paramCount=6, params=0xffffffffffffffff) at xptcinvoke_x86_64_linux.cpp:208
#19 0x00007ffff6448b7d in XPCWrappedNative::CallMethod (ccx=@0x7fffffff8500, 
    mode=<value optimized out>) at xpcwrappednative.cpp:2456
#20 0x00007ffff64513da in XPC_WN_CallMethod (cx=0x7fffdced4800, 
    obj=<value optimized out>, argc=<value optimized out>, 
    argv=<value optimized out>, vp=<value optimized out>)
    at xpcwrappednativejsops.cpp:1590
#21 0x00007ffff760c4c1 in js_Invoke (cx=0x7fffdced4800, 
    argc=<value optimized out>, vp=0x7fffdcef2518, flags=<value optimized out>)
    at jsinterp.cpp:1386
#22 0x00007ffff75fd753 in js_Interpret (cx=0x7fffdced4800) at jsinterp.cpp:5179
#23 0x00007ffff760bd7b in js_Execute (cx=0x7fffdced4800, chain=0x7fffdbd710c0, 
    script=0x6, down=0x0, flags=<value optimized out>, result=0x0)
    at jsinterp.cpp:1622
---Type <return> to continue, or q <return> to quit---
#24 0x00007ffff75d4fd4 in JS_EvaluateUCScriptForPrincipals (cx=0x7fffdced4800, 
    obj=0x7fffdbd710c0, principals=<value optimized out>, 
    chars=<value optimized out>, length=<value optimized out>, 
    filename=<value optimized out>, lineno=1, rval=0x0) at jsapi.cpp:5145
#25 0x00007ffff686e3b7 in nsJSContext::EvaluateString (this=0x7fffea13b160, 
    aScript=<value optimized out>, aScopeObject=0x7fffdbd710c0, 
    aPrincipal=<value optimized out>, aURL=<value optimized out>, 
    aLineNo=<value optimized out>, aVersion=0, aRetValue=0x0, 
    aIsUndefined=0x7fffffff8d5c) at nsJSEnvironment.cpp:1681
#26 0x00007ffff6750c55 in nsScriptLoader::EvaluateScript (this=0x7fffdcd0edd0, 
    aRequest=<value optimized out>, aScript=<value optimized out>)
    at nsScriptLoader.cpp:686
#27 0x00007ffff6750de7 in nsScriptLoader::ProcessRequest (this=0x7fffdcd0edd0, 
    aRequest=0x7fffea4ce5b0) at nsScriptLoader.cpp:600
#28 0x00007ffff6752233 in nsScriptLoader::ProcessScriptElement (
    this=0x7fffdcd0edd0, aElement=0x7fffdadb3e60) at nsScriptLoader.cpp:554
#29 0x00007ffff674f7be in nsScriptElement::MaybeProcessScript (
    this=0x7fffdadb3e60) at nsScriptElement.cpp:193
#30 0x00007ffff67c0b45 in nsHTMLScriptElement::MaybeProcessScript (
    this=0x7fffdadb3e20) at nsHTMLScriptElement.cpp:546
#31 0x00007ffff67d9fa6 in HTMLContentSink::ProcessSCRIPTEndTag (
    this=0x7fffe7beb800, content=0x7fffdadb3e20, aMalformed=0)
    at nsHTMLContentSink.cpp:3142
#32 0x00007ffff67daa20 in SinkContext::CloseContainer (this=0x7fffdcd0ee70, 
    aTag=eHTMLTag_script, aMalformed=0) at nsHTMLContentSink.cpp:1023
#33 0x00007ffff655779d in CNavDTD::CloseContainer (this=0x7fffdbd03b30, 
    aTag=eHTMLTag_script, aMalformed=0) at CNavDTD.cpp:2804
#34 0x00007ffff65595d5 in CNavDTD::HandleEndToken (this=0x7fffdbd03b30, aToken=
    0x7fffdaf68260) at CNavDTD.cpp:1683
#35 0x00007ffff655a92d in CNavDTD::HandleToken (this=0x7fffdbd03b30, 
    aToken=0x7fffdaf68260, aParser=<value optimized out>) at CNavDTD.cpp:760
#36 0x00007ffff6558de1 in CNavDTD::BuildModel (this=0x7fffdbd03b30, 
    aParser=0x7fffdbf97e20, aTokenizer=<value optimized out>, 
    anObserver=<value optimized out>, aSink=<value optimized out>)
    at CNavDTD.cpp:332
#37 0x00007ffff6560c01 in nsParser::BuildModel (this=0x7fffdbf97e20)
    at nsParser.cpp:2400
#38 0x00007ffff6564593 in nsParser::ResumeParse (this=0x7fffdbf97e20, 
    allowIteration=1, aIsFinalChunk=1, aCanInterrupt=<value optimized out>)
    at nsParser.cpp:2273
#39 0x00007ffff65654dd in nsParser::ContinueInterruptedParsing (
    this=0x7fffdbf97e20) at nsParser.cpp:1773
#40 0x00007ffff66fd9b5 in nsRunnableMethod<nsContentSink>::Run (
    this=<value optimized out>)
    at ../../../dist/include/xpcom/nsThreadUtils.h:278
#41 0x00007ffff6cf2365 in nsThread::ProcessNextEvent (this=0x7ffff7c1b700, 
    mayWait=1, result=0x7fffffff976c) at nsThread.cpp:521
#42 0x00007ffff6cc3953 in NS_ProcessNextEvent_P (thread=0x3a36, mayWait=14902)
    at nsThreadUtils.cpp:236
#43 0x00007ffff6c37479 in nsBaseAppShell::Run (this=0x7fffef32f100)
---Type <return> to continue, or q <return> to quit---
    at nsBaseAppShell.cpp:170
#44 0x00007ffff6ae2444 in nsAppStartup::Run (this=0x7fffefb57d80)
    at nsAppStartup.cpp:193
#45 0x00007ffff641c5a4 in XRE_main (argc=<value optimized out>, 
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3321
#46 0x0000000000402616 in main (argc=1, argv=0x7fffffffe1a8)
    at nsXULStub.cpp:482
(gdb) quit
The program is running.  Quit anyway (and kill it)? (y or n) y
Comment 18 Martin Stransky 2009-12-04 15:50:25 UTC 
Does look like X failure...your Xorg.0.log would help here.
Comment 19 Jeff Garzik 2009-12-04 15:51:18 UTC 
Here is a second backtrace, after installing more debuginfo packages, and setting a breakpoint on "gdk_x_error" as the crash output recommended:

#0  gdk_x_error (display=0x7ffff7c93000, error=0x7fffffff7670)
    at gdkmain-x11.c:613
#1  0x0000003b4f0460b4 in _XError (dpy=0x7ffff7c93000, rep=0x7fffdac51b50)
    at XlibInt.c:2924
#2  0x0000003b4f04c3fc in process_responses (dpy=0x7ffff7c93000, 
    wait_for_first_event=<value optimized out>, 
    current_error=<value optimized out>, current_request=0) at xcb_io.c:207
#3  0x0000003b4f04cdb7 in _XEventsQueued (dpy=0x7ffff7c93000, 
    mode=<value optimized out>) at xcb_io.c:256
#4  0x0000003b4f035bfd in XPending (dpy=0x7ffff7c93000) at Pending.c:56
#5  0x0000003c78a4fa72 in gdk_event_prepare (source=<value optimized out>, 
    timeout=0x7fffffff785c) at gdkevents-x11.c:2325
#6  0x000000351e43a90a in IA__g_main_context_prepare (context=0x7ffff7c59870, 
    priority=<value optimized out>) at gmain.c:2144
#7  0x000000351e43ace1 in g_main_context_iterate (context=0x7ffff7c59870, 
    block=<value optimized out>, dispatch=<value optimized out>, 
    self=<value optimized out>) at gmain.c:2435
#8  0x000000351e43b20a in IA__g_main_context_iteration (
    context=0x7ffff7c59870, may_block=0) at gmain.c:2518
#9  0x00007ffff6c3722f in nsBaseAppShell::DoProcessNextNativeEvent (
    this=0x7ffff7c93000, mayWait=-35216) at nsBaseAppShell.cpp:151
#10 0x00007ffff6c37369 in nsBaseAppShell::OnProcessNextEvent (
    this=0x7fffef32f100, thr=0x7ffff7c1b700, mayWait=1, 
    recursionDepth=<value optimized out>) at nsBaseAppShell.cpp:284
#11 0x00007ffff6cf2310 in nsThread::ProcessNextEvent (this=0x7ffff7c1b700, 
    mayWait=1, result=0x7fffffff7a2c) at nsThread.cpp:508
#12 0x00007ffff6cc3953 in NS_ProcessNextEvent_P (thread=0x7ffff7c93000, 
    mayWait=-35216) at nsThreadUtils.cpp:236
#13 0x00007ffff676383c in nsXMLHttpRequest::Send (this=0x7fffe06d44c0, 
    aBody=<value optimized out>) at nsXMLHttpRequest.cpp:2825
#14 0x00007ffff6cfe791 in NS_InvokeByIndex_P (that=0x7ffff7c93000, 
    methodIndex=4294932080, paramCount=298, params=0x2d07)
    at xptcinvoke_x86_64_linux.cpp:208
#15 0x00007ffff6448b7d in XPCWrappedNative::CallMethod (ccx=@0x7fffffff8500, 
    mode=<value optimized out>) at xpcwrappednative.cpp:2456
#16 0x00007ffff64513da in XPC_WN_CallMethod (cx=0x7fffdceebc00, 
    obj=<value optimized out>, argc=<value optimized out>, 
    argv=<value optimized out>, vp=<value optimized out>)
    at xpcwrappednativejsops.cpp:1590
#17 0x00007ffff760c4c1 in js_Invoke (cx=0x7fffdceebc00, 
    argc=<value optimized out>, vp=0x7fffdcd4a518, flags=<value optimized out>)
    at jsinterp.cpp:1386
#18 0x00007ffff75fd753 in js_Interpret (cx=0x7fffdceebc00) at jsinterp.cpp:5179
#19 0x00007ffff760bd7b in js_Execute (cx=0x7fffdceebc00, chain=0x7fffdbdc5d00, 
    script=0x12a, down=0x0, flags=<value optimized out>, result=0x0)
    at jsinterp.cpp:1622
#20 0x00007ffff75d4fd4 in JS_EvaluateUCScriptForPrincipals (cx=0x7fffdceebc00, 
    obj=0x7fffdbdc5d00, principals=<value optimized out>, 
    chars=<value optimized out>, length=<value optimized out>, 
    filename=<value optimized out>, lineno=1, rval=0x0) at jsapi.cpp:5145
---Type <return> to continue, or q <return> to quit---
#21 0x00007ffff686e3b7 in nsJSContext::EvaluateString (this=0x7fffdcd25d60, 
    aScript=<value optimized out>, aScopeObject=0x7fffdbdc5d00, 
    aPrincipal=<value optimized out>, aURL=<value optimized out>, 
    aLineNo=<value optimized out>, aVersion=0, aRetValue=0x0, 
    aIsUndefined=0x7fffffff8d5c) at nsJSEnvironment.cpp:1681
#22 0x00007ffff6750c55 in nsScriptLoader::EvaluateScript (this=0x7fffdcd7a290, 
    aRequest=<value optimized out>, aScript=<value optimized out>)
    at nsScriptLoader.cpp:686
#23 0x00007ffff6750de7 in nsScriptLoader::ProcessRequest (this=0x7fffdcd7a290, 
    aRequest=0x7fffe84f0830) at nsScriptLoader.cpp:600
#24 0x00007ffff6752233 in nsScriptLoader::ProcessScriptElement (
    this=0x7fffdcd7a290, aElement=0x7fffdac397a0) at nsScriptLoader.cpp:554
#25 0x00007ffff674f7be in nsScriptElement::MaybeProcessScript (
    this=0x7fffdac397a0) at nsScriptElement.cpp:193
#26 0x00007ffff67c0b45 in nsHTMLScriptElement::MaybeProcessScript (
    this=0x7fffdac39760) at nsHTMLScriptElement.cpp:546
#27 0x00007ffff67d9fa6 in HTMLContentSink::ProcessSCRIPTEndTag (
    this=0x7fffe722d000, content=0x7fffdac39760, aMalformed=0)
    at nsHTMLContentSink.cpp:3142
#28 0x00007ffff67daa20 in SinkContext::CloseContainer (this=0x7fffdcd7a330, 
    aTag=eHTMLTag_script, aMalformed=0) at nsHTMLContentSink.cpp:1023
#29 0x00007ffff655779d in CNavDTD::CloseContainer (this=0x7fffdbd96b30, 
    aTag=eHTMLTag_script, aMalformed=0) at CNavDTD.cpp:2804
#30 0x00007ffff65595d5 in CNavDTD::HandleEndToken (this=0x7fffdbd96b30, aToken=
    0x7fffdafba260) at CNavDTD.cpp:1683
#31 0x00007ffff655a92d in CNavDTD::HandleToken (this=0x7fffdbd96b30, 
    aToken=0x7fffdafba260, aParser=<value optimized out>) at CNavDTD.cpp:760
#32 0x00007ffff6558de1 in CNavDTD::BuildModel (this=0x7fffdbd96b30, 
    aParser=0x7fffdbe17ef0, aTokenizer=<value optimized out>, 
    anObserver=<value optimized out>, aSink=<value optimized out>)
    at CNavDTD.cpp:332
#33 0x00007ffff6560c01 in nsParser::BuildModel (this=0x7fffdbe17ef0)
    at nsParser.cpp:2400
#34 0x00007ffff6564593 in nsParser::ResumeParse (this=0x7fffdbe17ef0, 
    allowIteration=1, aIsFinalChunk=1, aCanInterrupt=<value optimized out>)
    at nsParser.cpp:2273
#35 0x00007ffff65654dd in nsParser::ContinueInterruptedParsing (
    this=0x7fffdbe17ef0) at nsParser.cpp:1773
#36 0x00007ffff66fd9b5 in nsRunnableMethod<nsContentSink>::Run (
    this=<value optimized out>)
    at ../../../dist/include/xpcom/nsThreadUtils.h:278
#37 0x00007ffff6cf2365 in nsThread::ProcessNextEvent (this=0x7ffff7c1b700, 
    mayWait=1, result=0x7fffffff976c) at nsThread.cpp:521
#38 0x00007ffff6cc3953 in NS_ProcessNextEvent_P (thread=0x7ffff7c93000, 
    mayWait=-35216) at nsThreadUtils.cpp:236
#39 0x00007ffff6c37479 in nsBaseAppShell::Run (this=0x7fffef32f100)
    at nsBaseAppShell.cpp:170
#40 0x00007ffff6ae2444 in nsAppStartup::Run (this=0x7fffefb57d00)
    at nsAppStartup.cpp:193
#41 0x00007ffff641c5a4 in XRE_main (argc=<value optimized out>, 
---Type <return> to continue, or q <return> to quit---
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3321
#42 0x0000000000402616 in main (argc=1, argv=0x7fffffffe1a8)
    at nsXULStub.cpp:482
(gdb) quit
The program is running.  Quit anyway (and kill it)? (y or n) y
Comment 20 Jeff Garzik 2009-12-04 15:54:14 UTC 
Created attachment 376108 [details]
Xorg log

Warning, log is 68MB uncompressed.
Comment 21 Jeff Garzik 2009-12-04 15:57:45 UTC 
Here is a third backtrace, running with "--sync" on command line, and
setting a breakpoint on "gdk_x_error" as the crash output recommended:

#0  gdk_x_error (display=0x7ffff7c93000, error=0x7fffffff5960)
    at gdkmain-x11.c:613
#1  0x0000003b4f0460b4 in _XError (dpy=0x7ffff7c93000, rep=0x7fffdac287c0)
    at XlibInt.c:2924
#2  0x0000003b4f04c3fc in process_responses (dpy=0x7ffff7c93000, 
    wait_for_first_event=<value optimized out>, 
    current_error=<value optimized out>, current_request=36065) at xcb_io.c:207
#3  0x0000003b4f04caa0 in _XReply (dpy=0x7ffff7c93000, rep=0x7fffffff5b30, 
    extra=0, discard=1) at xcb_io.c:457
#4  0x0000003b4f040963 in XSync (dpy=0x7ffff7c93000, discard=0) at Sync.c:48
#5  0x0000003b4f040b1b in _XSyncFunction (dpy=0x7ffff7c93000) at Synchro.c:37
#6  0x0000003b4f026ec4 in XFreePixmap (dpy=0x7ffff7c93000, 
    pixmap=140737488312672) at FreePix.c:43
#7  0x0000003c7923ecd0 in _cairo_xlib_display_notify (display=0x7fffec957d30)
    at cairo-xlib-display.c:478
#8  0x0000003c7924489c in _cairo_xlib_surface_fill_rectangles (
    abstract_surface=0x7fffdcd17ca0, op=4294924640, color=0x12a, rects=0x8cdf, 
    num_rects=-135466944) at cairo-xlib-surface.c:1919
#9  0x0000003c7922bac7 in _cairo_surface_fill_rectangles (
    surface=0x7ffff7c93000, op=CAIRO_OPERATOR_CLEAR, color=0x3c7925c0e0, 
    rects=0x7fffffff6590, num_rects=-135466944) at cairo-surface.c:1458
#10 0x0000003c7922bcac in _cairo_surface_fill_region (surface=0x7fffdcd17ca0, 
    op=CAIRO_OPERATOR_CLEAR, color=0x3c7925c0e0, region=0x7fffffff6f90)
    at cairo-surface.c:1409
#11 0x0000003c7922e867 in _clip_and_composite_trapezoids (src=0x7fffdc08dce0, 
    op=CAIRO_OPERATOR_CLEAR, dst=0x7fffdcd17ca0, traps=0x7fffffff7010, 
    clip=0x0, antialias=<value optimized out>) at cairo-surface-fallback.c:617
#12 0x0000003c7922eebd in _cairo_surface_fallback_paint (
    surface=0x7fffdcd17ca0, op=CAIRO_OPERATOR_CLEAR, source=0x7fffdc08dce0)
    at cairo-surface-fallback.c:705
#13 0x0000003c7922b9ff in _cairo_surface_paint (surface=0x7fffdcd17ca0, 
    op=CAIRO_OPERATOR_CLEAR, source=<value optimized out>)
    at cairo-surface.c:1492
#14 0x0000003c7921467a in _cairo_gstate_paint (gstate=0x7fffdac35430)
    at cairo-gstate.c:878
#15 0x0000003c7920ea99 in *INT_cairo_paint (cr=0x7fffdac35400) at cairo.c:1947
#16 0x0000003c7920eb6d in cairo_paint_with_alpha (cr=0x7ffff7c93000, alpha=1)
    at cairo.c:1975
#17 0x00007ffff6d38358 in gfxPlatformGtk::CreateOffscreenSurface (
    this=<value optimized out>, size=@0x7fffdac3e218, 
    imageFormat=gfxASurface::ImageFormatARGB32) at gfxPlatformGtk.cpp:238
#18 0x00007ffff6d2c582 in gfxPlatform::OptimizeImage (this=0x7ffff7c93000, 
    aSurface=0x7fffdac3e200, format=298) at gfxPlatform.cpp:280
#19 0x00007ffff6c481ad in nsThebesImage::Optimize (this=0x7fffdac3c2b0, 
    aContext=<value optimized out>) at nsThebesImage.cpp:374
#20 0x00007ffff6d17638 in gfxImageFrame::SetMutable (
    this=<value optimized out>, aMutable=<value optimized out>)
    at gfxImageFrame.cpp:191
#21 0x00007ffff6583660 in imgContainer::DecodingComplete (
    this=<value optimized out>) at imgContainer.cpp:306
---Type <return> to continue, or q <return> to quit---
#22 0x00007ffff658e973 in end_callback (png_ptr=0x7fffdac34c00, 
    info_ptr=0x7fffdadc2d00) at nsPNGDecoder.cpp:869
#23 0x00007ffff6d49949 in MOZ_PNG_push_read_chunk (png_ptr=0x7fffdac34c00, 
    info_ptr=0x7fffdadc2d00) at pngpread.c:348
#24 0x00007ffff6d49da0 in MOZ_PNG_process_data (png_ptr=0x7fffdac34c00, 
    info_ptr=0x7fffdadc2d00, buffer=0x12a <Address 0x12a out of bounds>, 
    buffer_size=<value optimized out>) at pngpread.c:35
#25 0x00007ffff658e250 in ReadDataOut(struct nsIInputStream *, void *, const char *, PRUint32, PRUint32, PRUint32 *) (in=<value optimized out>, 
    closure=<value optimized out>, fromRawSegment=<value optimized out>, 
    toOffset=<value optimized out>, count=36063, 
    writeCount=<value optimized out>) at nsPNGDecoder.cpp:351
#26 0x00007ffff6cd9b58 in nsInputStreamTee::WriteSegmentFun (
    in=0x7ffff7c93000, closure=0x7fffdac28730, 
    fromSegment=0x12a <Address 0x12a out of bounds>, offset=36063, 
    count=4159500352, writeCount=0x0) at nsInputStreamTee.cpp:102
#27 0x00007ffff6cdd1e6 in nsPipeInputStream::ReadSegments (
    this=0x7fffdaf6cd10, 
    writer=0x7ffff6cd9b44 <nsInputStreamTee::WriteSegmentFun(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*)>, 
    closure=0x7fffdac28730, count=3122, readCount=0x7fffffff7768)
    at nsPipe3.cpp:799
#28 0x00007ffff658e13e in nsPNGDecoder::WriteFrom (this=0x7fffdac3c240, 
    inStr=0x7ffff7c93000, count=<value optimized out>, _retval=0x7fffffff7768)
    at nsPNGDecoder.cpp:370
#29 0x00007ffff658b1e5 in imgRequest::OnDataAvailable (this=0x7fffdae936a0, 
    aRequest=0x7fffffff7730, ctxt=<value optimized out>, inStr=0x7fffdac28730, 
    sourceOffset=4159500352, count=3122) at imgRequest.cpp:993
#30 0x00007ffff64a96a1 in nsStreamListenerTee::OnDataAvailable (
    this=0x7fffdac28700, request=<value optimized out>, context=0x0, 
    input=0x7fffdaf6cd10, offset=0, count=3122) at nsStreamListenerTee.cpp:97
#31 0x00007ffff64f9d79 in nsHttpChannel::OnDataAvailable (this=0x7fffdae6f000, 
    request=<value optimized out>, ctxt=<value optimized out>, 
    input=0x7fffdaf6cd10, offset=<value optimized out>, 
    count=<value optimized out>) at nsHttpChannel.cpp:5046
#32 0x00007ffff64922ed in nsInputStreamPump::OnStateTransfer (
    this=0x7fffdad2cd30) at nsInputStreamPump.cpp:508
#33 0x00007ffff64923e9 in nsInputStreamPump::OnInputStreamReady (
    this=0x7fffdad2cd30, stream=0x7fffffff5960) at nsInputStreamPump.cpp:398
#34 0x00007ffff6cddf8a in nsInputStreamReadyEvent::Run (this=0x7fffdae89070)
    at nsStreamUtils.cpp:111
#35 0x00007ffff6cf2365 in nsThread::ProcessNextEvent (this=0x7ffff7c1b700, 
    mayWait=1, result=0x7fffffff7a1c) at nsThread.cpp:521
#36 0x00007ffff6cc3953 in NS_ProcessNextEvent_P (thread=0x7ffff7c93000, 
    mayWait=-42656) at nsThreadUtils.cpp:236
#37 0x00007ffff676383c in nsXMLHttpRequest::Send (this=0x7fffe06d1300, 
    aBody=<value optimized out>) at nsXMLHttpRequest.cpp:2825
#38 0x00007ffff6cfe791 in NS_InvokeByIndex_P (that=0x7ffff7c93000, 
    methodIndex=4294924640, paramCount=298, params=0x8cdf)
    at xptcinvoke_x86_64_linux.cpp:208
---Type <return> to continue, or q <return> to quit---
#39 0x00007ffff6448b7d in XPCWrappedNative::CallMethod (ccx=@0x7fffffff84f0, 
    mode=<value optimized out>) at xpcwrappednative.cpp:2456
#40 0x00007ffff64513da in XPC_WN_CallMethod (cx=0x7fffe05a0400, 
    obj=<value optimized out>, argc=<value optimized out>, 
    argv=<value optimized out>, vp=<value optimized out>)
    at xpcwrappednativejsops.cpp:1590
#41 0x00007ffff760c4c1 in js_Invoke (cx=0x7fffe05a0400, 
    argc=<value optimized out>, vp=0x7fffdceeb518, flags=<value optimized out>)
    at jsinterp.cpp:1386
#42 0x00007ffff75fd753 in js_Interpret (cx=0x7fffe05a0400) at jsinterp.cpp:5179
#43 0x00007ffff760bd7b in js_Execute (cx=0x7fffe05a0400, chain=0x7fffdbd8dc40, 
    script=0x12a, down=0x0, flags=<value optimized out>, result=0x0)
    at jsinterp.cpp:1622
#44 0x00007ffff75d4fd4 in JS_EvaluateUCScriptForPrincipals (cx=0x7fffe05a0400, 
    obj=0x7fffdbd8dc40, principals=<value optimized out>, 
    chars=<value optimized out>, length=<value optimized out>, 
    filename=<value optimized out>, lineno=1, rval=0x0) at jsapi.cpp:5145
#45 0x00007ffff686e3b7 in nsJSContext::EvaluateString (this=0x7fffdcecaa00, 
    aScript=<value optimized out>, aScopeObject=0x7fffdbd8dc40, 
    aPrincipal=<value optimized out>, aURL=<value optimized out>, 
    aLineNo=<value optimized out>, aVersion=0, aRetValue=0x0, 
    aIsUndefined=0x7fffffff8d4c) at nsJSEnvironment.cpp:1681
#46 0x00007ffff6750c55 in nsScriptLoader::EvaluateScript (this=0x7fffdcd2d060, 
    aRequest=<value optimized out>, aScript=<value optimized out>)
    at nsScriptLoader.cpp:686
#47 0x00007ffff6750de7 in nsScriptLoader::ProcessRequest (this=0x7fffdcd2d060, 
    aRequest=0x7fffdbc1c790) at nsScriptLoader.cpp:600
#48 0x00007ffff6752233 in nsScriptLoader::ProcessScriptElement (
    this=0x7fffdcd2d060, aElement=0x7fffdac15aa0) at nsScriptLoader.cpp:554
#49 0x00007ffff674f7be in nsScriptElement::MaybeProcessScript (
    this=0x7fffdac15aa0) at nsScriptElement.cpp:193
#50 0x00007ffff67c0b45 in nsHTMLScriptElement::MaybeProcessScript (
    this=0x7fffdac15a60) at nsHTMLScriptElement.cpp:546
#51 0x00007ffff67d9fa6 in HTMLContentSink::ProcessSCRIPTEndTag (
    this=0x7fffe7209000, content=0x7fffdac15a60, aMalformed=0)
    at nsHTMLContentSink.cpp:3142
#52 0x00007ffff67daa20 in SinkContext::CloseContainer (this=0x7fffdcd2d100, 
    aTag=eHTMLTag_script, aMalformed=0) at nsHTMLContentSink.cpp:1023
#53 0x00007ffff655779d in CNavDTD::CloseContainer (this=0x7fffdbd6da00, 
    aTag=eHTMLTag_script, aMalformed=0) at CNavDTD.cpp:2804
#54 0x00007ffff65595d5 in CNavDTD::HandleEndToken (this=0x7fffdbd6da00, aToken=
    0x7fffdafc3260) at CNavDTD.cpp:1683
#55 0x00007ffff655a92d in CNavDTD::HandleToken (this=0x7fffdbd6da00, 
    aToken=0x7fffdafc3260, aParser=<value optimized out>) at CNavDTD.cpp:760
#56 0x00007ffff6558de1 in CNavDTD::BuildModel (this=0x7fffdbd6da00, 
    aParser=0x7fffdbe081b0, aTokenizer=<value optimized out>, 
    anObserver=<value optimized out>, aSink=<value optimized out>)
    at CNavDTD.cpp:332
#57 0x00007ffff6560c01 in nsParser::BuildModel (this=0x7fffdbe081b0)
    at nsParser.cpp:2400
---Type <return> to continue, or q <return> to quit---
#58 0x00007ffff6564593 in nsParser::ResumeParse (this=0x7fffdbe081b0, 
    allowIteration=1, aIsFinalChunk=1, aCanInterrupt=<value optimized out>)
    at nsParser.cpp:2273
#59 0x00007ffff65654dd in nsParser::ContinueInterruptedParsing (
    this=0x7fffdbe081b0) at nsParser.cpp:1773
#60 0x00007ffff66fd9b5 in nsRunnableMethod<nsContentSink>::Run (
    this=<value optimized out>)
    at ../../../dist/include/xpcom/nsThreadUtils.h:278
#61 0x00007ffff6cf2365 in nsThread::ProcessNextEvent (this=0x7ffff7c1b700, 
    mayWait=1, result=0x7fffffff975c) at nsThread.cpp:521
#62 0x00007ffff6cc3953 in NS_ProcessNextEvent_P (thread=0x7ffff7c93000, 
    mayWait=-42656) at nsThreadUtils.cpp:236
#63 0x00007ffff6c37479 in nsBaseAppShell::Run (this=0x7fffef32f100)
    at nsBaseAppShell.cpp:170
#64 0x00007ffff6ae2444 in nsAppStartup::Run (this=0x7fffefb5ad80)
    at nsAppStartup.cpp:193
#65 0x00007ffff641c5a4 in XRE_main (argc=<value optimized out>, 
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:3321
#66 0x0000000000402616 in main (argc=2, argv=0x7fffffffe198)
    at nsXULStub.cpp:482
Comment 22 pleabargain 2009-12-08 14:30:16 UTC 
Created attachment 376912 [details]
firefox -g on usaa.com... page loaded fine

firefox -g on usaa.com... page loaded fine

but no other pages in new tabs would load.
Comment 23 pleabargain 2009-12-08 14:42:08 UTC 
Created attachment 376916 [details]
usaa loaded once then won't load again

page loaded once but wouldn't load again.
loads fine with Opera
loads fine with Chromium
Comment 24 Chris Campbell 2009-12-28 19:55:41 UTC 
*** Bug 550847 has been marked as a duplicate of this bug. ***
Comment 25 Chris Campbell 2009-12-28 20:08:20 UTC 
*** Bug 550734 has been marked as a duplicate of this bug. ***
Comment 26 Chris Campbell 2010-01-14 20:11:04 UTC 
*** Bug 555566 has been marked as a duplicate of this bug. ***
Comment 27 Chris Campbell 2010-01-14 20:14:01 UTC 
*** Bug 555572 has been marked as a duplicate of this bug. ***
Comment 28 Chris Campbell 2010-03-13 13:30:24 UTC 
*** Bug 573117 has been marked as a duplicate of this bug. ***
Comment 29 Martin Stransky 2010-03-19 14:11:32 UTC 
Looks like a duplicate of 556926

*** This bug has been marked as a duplicate of bug 556926 ***